Merge remote-tracking branch 'origin/master'

[unleashed/lotheac.git] / usr / src / uts / common / io / mac / mac_protect.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
 */
/*
 * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
 */

#include <sys/cmn_err.h>
#include <sys/strsun.h>
#include <sys/sdt.h>
#include <sys/mac.h>
#include <sys/mac_impl.h>
#include <sys/mac_client_impl.h>
#include <sys/mac_client_priv.h>
#include <sys/ethernet.h>
#include <sys/vlan.h>
#include <sys/dlpi.h>
#include <sys/avl.h>
#include <inet/ip.h>
#include <inet/ip6.h>
#include <inet/arp.h>
#include <netinet/arp.h>
#include <netinet/udp.h>
#include <netinet/dhcp.h>
#include <netinet/dhcp6.h>

/*
 * Implementation overview for DHCP address detection
 *
 * The purpose of DHCP address detection is to relieve the user of having to
 * manually configure static IP addresses when ip-nospoof protection is turned
 * on. To achieve this, the mac layer needs to intercept DHCP packets to
 * determine the assigned IP addresses.
 *
 * A DHCP handshake between client and server typically requires at least
 * 4 messages:
 *
 * 1. DISCOVER - client attempts to locate DHCP servers via a
 *               broadcast message to its subnet.
 * 2. OFFER    - server responds to client with an IP address and
 *               other parameters.
 * 3. REQUEST  - client requests the offered address.
 * 4. ACK      - server verifies that the requested address matches
 *               the one it offered.
 *
 * DHCPv6 behaves pretty much the same way aside from different message names.
 *
 * Address information is embedded in either the OFFER or REQUEST message.
 * We chose to intercept REQUEST because this is at the last part of the
 * handshake and it indicates that the client intends to keep the address.
 * Intercepting OFFERs is unreliable because the client may receive multiple
 * offers from different servers, and we can't tell which address the client
 * will keep.
 *
 * Each DHCP message has a transaction ID. We use this transaction ID to match
 * REQUESTs with ACKs received from servers.
 *
 * For IPv4, the process to acquire a DHCP-assigned address is as follows:
 *
 * 1. Client sends REQUEST. a new dhcpv4_txn_t object is created and inserted
 *    in the the mci_v4_pending_txn table (keyed by xid). This object represents
 *    a new transaction. It contains the xid, the client ID and requested IP
 *    address.
 *
 * 2. Server responds with an ACK. The xid from this ACK is used to lookup the
 *    pending transaction from the mci_v4_pending_txn table. Once the object is
 *    found, it is removed from the pending table and inserted into the
 *    completed table (mci_v4_completed_txn, keyed by client ID) and the dynamic
 *    IP table (mci_v4_dyn_ip, keyed by IP address).
 *
 * 3. An outgoing packet that goes through the ip-nospoof path will be checked
 *    against the dynamic IP table. Packets that have the assigned DHCP address
 *    as the source IP address will pass the check and be admitted onto the
 *    network.
 *
 * IPv4 notes:
 *
 * If the server never responds with an ACK, there is a timer that is set after
 * the insertion of the transaction into the pending table. When the timer
 * fires, it will check whether the transaction is old (by comparing current
 * time and the txn's timestamp), if so the transaction will be freed. along
 * with this, any transaction in the completed/dyn-ip tables matching the client
 * ID of this stale transaction will also be freed. If the client fails to
 * extend a lease, we want to stop the client from using any IP addresses that
 * were granted previously.
 *
 * A RELEASE message from the client will not cause a transaction to be created.
 * The client ID in the RELEASE message will be used for finding and removing
 * transactions in the completed and dyn-ip tables.
 *
 *
 * For IPv6, the process to acquire a DHCPv6-assigned address is as follows:
 *
 * 1. Client sends REQUEST. The DUID is extracted and stored into a dhcpv6_cid_t
 *    structure. A new transaction structure (dhcpv6_txn_t) is also created and
 *    it will point to the dhcpv6_cid_t. If an existing transaction with a
 *    matching xid is not found, this dhcpv6_txn_t will be inserted into the
 *    mci_v6_pending_txn table (keyed by xid).
 *
 * 2. Server responds with a REPLY. If a pending transaction is found, the
 *    addresses in the reply will be placed into the dhcpv6_cid_t pointed to by
 *    the transaction. The dhcpv6_cid_t will then be moved to the mci_v6_cid
 *    table (keyed by cid). The associated addresses will be added to the
 *    mci_v6_dyn_ip table (while still being pointed to by the dhcpv6_cid_t).
 *
 * 3. IPv6 ip-nospoof will now check mci_v6_dyn_ip for matching packets.
 *    Packets with a source address matching one of the DHCPv6-assigned
 *    addresses will be allowed through.
 *
 * IPv6 notes:
 *
 * The v6 code shares the same timer as v4 for scrubbing stale transactions.
 * Just like v4, as part of removing an expired transaction, a RELEASE will be
 * be triggered on the cid associated with the expired transaction.
 *
 * The data structures used for v6 are slightly different because a v6 client
 * may have multiple addresses associated with it.
 */

/*
 * These are just arbitrary limits meant for preventing abuse (e.g. a user
 * flooding the network with bogus transactions). They are not meant to be
 * user-modifiable so they are not exposed as linkprops.
 */
static ulong_t  dhcp_max_pending_txn = 512;
static ulong_t  dhcp_max_completed_txn = 512;
static ulong_t  slaac_max_allowed = 512;
static hrtime_t txn_cleanup_interval = 60 * NANOSEC;

/*
 * DHCPv4 transaction. It may be added to three different tables
 * (keyed by different fields).
 */
typedef struct dhcpv4_txn {
        uint32_t                dt_xid;
        hrtime_t                dt_timestamp;
        uint8_t                 dt_cid[DHCP_MAX_OPT_SIZE];
        uint8_t                 dt_cid_len;
        ipaddr_t                dt_ipaddr;
        avl_node_t              dt_node;
        avl_node_t              dt_ipnode;
        struct dhcpv4_txn       *dt_next;
} dhcpv4_txn_t;

/*
 * DHCPv6 address. May be added to mci_v6_dyn_ip.
 * It is always pointed to by its parent dhcpv6_cid_t structure.
 */
typedef struct dhcpv6_addr {
        in6_addr_t              da_addr;
        avl_node_t              da_node;
        struct dhcpv6_addr      *da_next;
} dhcpv6_addr_t;

/*
 * DHCPv6 client ID. May be added to mci_v6_cid.
 * No dhcpv6_txn_t should be pointing to it after it is added to mci_v6_cid.
 */
typedef struct dhcpv6_cid {
        uchar_t                 *dc_cid;
        uint_t                  dc_cid_len;
        dhcpv6_addr_t           *dc_addr;
        uint_t                  dc_addrcnt;
        avl_node_t              dc_node;
} dhcpv6_cid_t;

/*
 * DHCPv6 transaction. Unlike its v4 counterpart, this object gets freed up
 * as soon as the transaction completes or expires.
 */
typedef struct dhcpv6_txn {
        uint32_t                dt_xid;
        hrtime_t                dt_timestamp;
        dhcpv6_cid_t            *dt_cid;
        avl_node_t              dt_node;
        struct dhcpv6_txn       *dt_next;
} dhcpv6_txn_t;

/*
 * Stateless address autoconfiguration (SLAAC) address. May be added to
 * mci_v6_slaac_ip.
 */
typedef struct slaac_addr {
        in6_addr_t              sla_prefix;
        in6_addr_t              sla_addr;
        avl_node_t              sla_node;
} slaac_addr_t;

static void     start_txn_cleanup_timer(mac_client_impl_t *);
static boolean_t allowed_ips_set(mac_resource_props_t *, uint32_t);

#define BUMP_STAT(m, s) (m)->mci_misc_stat.mms_##s++

/*
 * Comparison functions for the 3 AVL trees used:
 * mci_v4_pending_txn, mci_v4_completed_txn, mci_v4_dyn_ip
 */
static int
compare_dhcpv4_xid(const void *arg1, const void *arg2)
{
        const dhcpv4_txn_t      *txn1 = arg1, *txn2 = arg2;

        if (txn1->dt_xid < txn2->dt_xid)
                return (-1);
        else if (txn1->dt_xid > txn2->dt_xid)
                return (1);
        else
                return (0);
}

static int
compare_dhcpv4_cid(const void *arg1, const void *arg2)
{
        const dhcpv4_txn_t      *txn1 = arg1, *txn2 = arg2;
        int                     ret;

        if (txn1->dt_cid_len < txn2->dt_cid_len)
                return (-1);
        else if (txn1->dt_cid_len > txn2->dt_cid_len)
                return (1);

        if (txn1->dt_cid_len == 0)
                return (0);

        ret = memcmp(txn1->dt_cid, txn2->dt_cid, txn1->dt_cid_len);
        if (ret < 0)
                return (-1);
        else if (ret > 0)
                return (1);
        else
                return (0);
}

static int
compare_dhcpv4_ip(const void *arg1, const void *arg2)
{
        const dhcpv4_txn_t      *txn1 = arg1, *txn2 = arg2;

        if (txn1->dt_ipaddr < txn2->dt_ipaddr)
                return (-1);
        else if (txn1->dt_ipaddr > txn2->dt_ipaddr)
                return (1);
        else
                return (0);
}

/*
 * Find the specified DHCPv4 option.
 */
static int
get_dhcpv4_option(struct dhcp *dh4, uchar_t *end, uint8_t type,
    uchar_t **opt, uint8_t *opt_len)
{
        uchar_t         *start = (uchar_t *)dh4->options;
        uint8_t         otype, olen;

        while (start < end) {
                if (*start == CD_PAD) {
                        start++;
                        continue;
                }
                if (*start == CD_END)
                        break;

                otype = *start++;
                olen = *start++;
                if (otype == type && olen > 0) {
                        *opt = start;
                        *opt_len = olen;
                        return (0);
                }
                start += olen;
        }
        return (ENOENT);
}

/*
 * Locate the start of a DHCPv4 header.
 * The possible return values and associated meanings are:
 * 0      - packet is DHCP and has a DHCP header.
 * EINVAL - packet is not DHCP. the recommended action is to let it pass.
 * ENOSPC - packet is a initial fragment that is DHCP or is unidentifiable.
 *          the recommended action is to drop it.
 */
static int
get_dhcpv4_info(ipha_t *ipha, uchar_t *end, struct dhcp **dh4)
{
        uint16_t        offset_and_flags, client, server;
        boolean_t       first_frag = B_FALSE;
        struct udphdr   *udph;
        uchar_t         *dh;

        if (ipha->ipha_protocol != IPPROTO_UDP)
                return (EINVAL);

        offset_and_flags = ntohs(ipha->ipha_fragment_offset_and_flags);
        if ((offset_and_flags & (IPH_MF | IPH_OFFSET)) != 0) {
                /*
                 * All non-initial fragments may pass because we cannot
                 * identify their type. It's safe to let them through
                 * because reassembly will fail if we decide to drop the
                 * initial fragment.
                 */
                if (((offset_and_flags << 3) & 0xffff) != 0)
                        return (EINVAL);
                first_frag = B_TRUE;
        }
        /* drop packets without a udp header */
        udph = (struct udphdr *)((uchar_t *)ipha + IPH_HDR_LENGTH(ipha));
        if ((uchar_t *)&udph[1] > end)
                return (ENOSPC);

        client = htons(IPPORT_BOOTPC);
        server = htons(IPPORT_BOOTPS);
        if (udph->uh_sport != client && udph->uh_sport != server &&
            udph->uh_dport != client && udph->uh_dport != server)
                return (EINVAL);

        /* drop dhcp fragments */
        if (first_frag)
                return (ENOSPC);

        dh = (uchar_t *)&udph[1];
        if (dh + BASE_PKT_SIZE > end)
                return (EINVAL);

        *dh4 = (struct dhcp *)dh;
        return (0);
}

/*
 * Wrappers for accesses to avl trees to improve readability.
 * Their purposes are fairly self-explanatory.
 */
static dhcpv4_txn_t *
find_dhcpv4_pending_txn(mac_client_impl_t *mcip, uint32_t xid)
{
        dhcpv4_txn_t    tmp_txn;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        tmp_txn.dt_xid = xid;
        return (avl_find(&mcip->mci_v4_pending_txn, &tmp_txn, NULL));
}

static int
insert_dhcpv4_pending_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
{
        avl_index_t     where;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        if (avl_find(&mcip->mci_v4_pending_txn, txn, &where) != NULL)
                return (EEXIST);

        if (avl_numnodes(&mcip->mci_v4_pending_txn) >= dhcp_max_pending_txn) {
                BUMP_STAT(mcip, dhcpdropped);
                return (EAGAIN);
        }
        avl_insert(&mcip->mci_v4_pending_txn, txn, where);
        return (0);
}

static void
remove_dhcpv4_pending_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
{
        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        avl_remove(&mcip->mci_v4_pending_txn, txn);
}

static dhcpv4_txn_t *
find_dhcpv4_completed_txn(mac_client_impl_t *mcip, uint8_t *cid,
    uint8_t cid_len)
{
        dhcpv4_txn_t    tmp_txn;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        if (cid_len > 0)
                bcopy(cid, tmp_txn.dt_cid, cid_len);
        tmp_txn.dt_cid_len = cid_len;
        return (avl_find(&mcip->mci_v4_completed_txn, &tmp_txn, NULL));
}

/*
 * After a pending txn is removed from the pending table, it is inserted
 * into both the completed and dyn-ip tables. These two insertions are
 * done together because a client ID must have 1:1 correspondence with
 * an IP address and IP addresses must be unique in the dyn-ip table.
 */
static int
insert_dhcpv4_completed_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
{
        avl_index_t     where;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        if (avl_find(&mcip->mci_v4_completed_txn, txn, &where) != NULL)
                return (EEXIST);

        if (avl_numnodes(&mcip->mci_v4_completed_txn) >=
            dhcp_max_completed_txn) {
                BUMP_STAT(mcip, dhcpdropped);
                return (EAGAIN);
        }

        avl_insert(&mcip->mci_v4_completed_txn, txn, where);
        if (avl_find(&mcip->mci_v4_dyn_ip, txn, &where) != NULL) {
                avl_remove(&mcip->mci_v4_completed_txn, txn);
                return (EEXIST);
        }
        avl_insert(&mcip->mci_v4_dyn_ip, txn, where);
        return (0);
}

static void
remove_dhcpv4_completed_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
{
        dhcpv4_txn_t    *ctxn;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        if ((ctxn = avl_find(&mcip->mci_v4_dyn_ip, txn, NULL)) != NULL &&
            ctxn == txn)
                avl_remove(&mcip->mci_v4_dyn_ip, txn);

        avl_remove(&mcip->mci_v4_completed_txn, txn);
}

/*
 * Check whether an IP address is in the dyn-ip table.
 */
static boolean_t
check_dhcpv4_dyn_ip(mac_client_impl_t *mcip, ipaddr_t ipaddr)
{
        dhcpv4_txn_t    tmp_txn, *txn;

        mutex_enter(&mcip->mci_protect_lock);
        tmp_txn.dt_ipaddr = ipaddr;
        txn = avl_find(&mcip->mci_v4_dyn_ip, &tmp_txn, NULL);
        mutex_exit(&mcip->mci_protect_lock);
        return (txn != NULL);
}

/*
 * Create/destroy a DHCPv4 transaction.
 */
static dhcpv4_txn_t *
create_dhcpv4_txn(uint32_t xid, uint8_t *cid, uint8_t cid_len, ipaddr_t ipaddr)
{
        dhcpv4_txn_t    *txn;

        if ((txn = kmem_zalloc(sizeof (*txn), KM_NOSLEEP)) == NULL)
                return (NULL);

        txn->dt_xid = xid;
        txn->dt_timestamp = gethrtime();
        if (cid_len > 0)
                bcopy(cid, &txn->dt_cid, cid_len);
        txn->dt_cid_len = cid_len;
        txn->dt_ipaddr = ipaddr;
        return (txn);
}

static void
free_dhcpv4_txn(dhcpv4_txn_t *txn)
{
        kmem_free(txn, sizeof (*txn));
}

/*
 * Clean up all v4 tables.
 */
static void
flush_dhcpv4(mac_client_impl_t *mcip)
{
        void            *cookie = NULL;
        dhcpv4_txn_t    *txn;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        while ((txn = avl_destroy_nodes(&mcip->mci_v4_dyn_ip,
            &cookie)) != NULL) {
                /*
                 * No freeing needed here because the same txn exists
                 * in the mci_v4_completed_txn table as well.
                 */
        }
        cookie = NULL;
        while ((txn = avl_destroy_nodes(&mcip->mci_v4_completed_txn,
            &cookie)) != NULL) {
                free_dhcpv4_txn(txn);
        }
        cookie = NULL;
        while ((txn = avl_destroy_nodes(&mcip->mci_v4_pending_txn,
            &cookie)) != NULL) {
                free_dhcpv4_txn(txn);
        }
}

/*
 * Cleanup stale DHCPv4 transactions.
 */
static void
txn_cleanup_v4(mac_client_impl_t *mcip)
{
        dhcpv4_txn_t            *txn, *ctxn, *next, *txn_list = NULL;

        /*
         * Find stale pending transactions and place them on a list
         * to be removed.
         */
        for (txn = avl_first(&mcip->mci_v4_pending_txn); txn != NULL;
            txn = avl_walk(&mcip->mci_v4_pending_txn, txn, AVL_AFTER)) {
                if (gethrtime() - txn->dt_timestamp > txn_cleanup_interval) {
                        DTRACE_PROBE2(found__expired__txn,
                            mac_client_impl_t *, mcip,
                            dhcpv4_txn_t *, txn);

                        txn->dt_next = txn_list;
                        txn_list = txn;
                }
        }

        /*
         * Remove and free stale pending transactions and completed
         * transactions with the same client IDs as the stale transactions.
         */
        for (txn = txn_list; txn != NULL; txn = next) {
                avl_remove(&mcip->mci_v4_pending_txn, txn);

                ctxn = find_dhcpv4_completed_txn(mcip, txn->dt_cid,
                    txn->dt_cid_len);
                if (ctxn != NULL) {
                        DTRACE_PROBE2(removing__completed__txn,
                            mac_client_impl_t *, mcip,
                            dhcpv4_txn_t *, ctxn);

                        remove_dhcpv4_completed_txn(mcip, ctxn);
                        free_dhcpv4_txn(ctxn);
                }
                next = txn->dt_next;
                txn->dt_next = NULL;

                DTRACE_PROBE2(freeing__txn, mac_client_impl_t *, mcip,
                    dhcpv4_txn_t *, txn);
                free_dhcpv4_txn(txn);
        }
}

/*
 * Core logic for intercepting outbound DHCPv4 packets.
 */
static boolean_t
intercept_dhcpv4_outbound(mac_client_impl_t *mcip, ipha_t *ipha, uchar_t *end)
{
        struct dhcp             *dh4;
        uchar_t                 *opt;
        dhcpv4_txn_t            *txn, *ctxn;
        ipaddr_t                ipaddr;
        uint8_t                 opt_len, mtype, cid[DHCP_MAX_OPT_SIZE], cid_len;
        mac_resource_props_t    *mrp = MCIP_RESOURCE_PROPS(mcip);

        if (get_dhcpv4_info(ipha, end, &dh4) != 0)
                return (B_TRUE);

        /* ip_nospoof/allowed-ips and DHCP are mutually exclusive by default */
        if (allowed_ips_set(mrp, IPV4_VERSION))
                return (B_FALSE);

        if (get_dhcpv4_option(dh4, end, CD_DHCP_TYPE, &opt, &opt_len) != 0 ||
            opt_len != 1) {
                DTRACE_PROBE2(mtype__not__found, mac_client_impl_t *, mcip,
                    struct dhcp *, dh4);
                return (B_TRUE);
        }
        mtype = *opt;
        if (mtype != REQUEST && mtype != RELEASE) {
                DTRACE_PROBE3(ignored__mtype, mac_client_impl_t *, mcip,
                    struct dhcp *, dh4, uint8_t, mtype);
                return (B_TRUE);
        }

        /* client ID is optional for IPv4 */
        if (get_dhcpv4_option(dh4, end, CD_CLIENT_ID, &opt, &opt_len) == 0 &&
            opt_len >= 2) {
                bcopy(opt, cid, opt_len);
                cid_len = opt_len;
        } else {
                bzero(cid, DHCP_MAX_OPT_SIZE);
                cid_len = 0;
        }

        mutex_enter(&mcip->mci_protect_lock);
        if (mtype == RELEASE) {
                DTRACE_PROBE2(release, mac_client_impl_t *, mcip,
                    struct dhcp *, dh4);

                /* flush any completed txn with this cid */
                ctxn = find_dhcpv4_completed_txn(mcip, cid, cid_len);
                if (ctxn != NULL) {
                        DTRACE_PROBE2(release__successful, mac_client_impl_t *,
                            mcip, struct dhcp *, dh4);

                        remove_dhcpv4_completed_txn(mcip, ctxn);
                        free_dhcpv4_txn(ctxn);
                }
                goto done;
        }

        /*
         * If a pending txn already exists, we'll update its timestamp so
         * it won't get flushed by the timer. We don't need to create new
         * txns for retransmissions.
         */
        if ((txn = find_dhcpv4_pending_txn(mcip, dh4->xid)) != NULL) {
                DTRACE_PROBE2(update, mac_client_impl_t *, mcip,
                    dhcpv4_txn_t *, txn);
                txn->dt_timestamp = gethrtime();
                goto done;
        }

        if (get_dhcpv4_option(dh4, end, CD_REQUESTED_IP_ADDR,
            &opt, &opt_len) != 0 || opt_len != sizeof (ipaddr)) {
                DTRACE_PROBE2(ipaddr__not__found, mac_client_impl_t *, mcip,
                    struct dhcp *, dh4);
                goto done;
        }
        bcopy(opt, &ipaddr, sizeof (ipaddr));
        if ((txn = create_dhcpv4_txn(dh4->xid, cid, cid_len, ipaddr)) == NULL)
                goto done;

        if (insert_dhcpv4_pending_txn(mcip, txn) != 0) {
                DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
                    dhcpv4_txn_t *, txn);
                free_dhcpv4_txn(txn);
                goto done;
        }
        start_txn_cleanup_timer(mcip);

        DTRACE_PROBE2(txn__pending, mac_client_impl_t *, mcip,
            dhcpv4_txn_t *, txn);

done:
        mutex_exit(&mcip->mci_protect_lock);
        return (B_TRUE);
}

/*
 * Core logic for intercepting inbound DHCPv4 packets.
 */
static void
intercept_dhcpv4_inbound(mac_client_impl_t *mcip, uchar_t *end,
    struct dhcp *dh4)
{
        uchar_t         *opt;
        dhcpv4_txn_t    *txn, *ctxn;
        uint8_t         opt_len, mtype;

        if (get_dhcpv4_option(dh4, end, CD_DHCP_TYPE, &opt, &opt_len) != 0 ||
            opt_len != 1) {
                DTRACE_PROBE2(mtype__not__found, mac_client_impl_t *, mcip,
                    struct dhcp *, dh4);
                return;
        }
        mtype = *opt;
        if (mtype != ACK && mtype != NAK) {
                DTRACE_PROBE3(ignored__mtype, mac_client_impl_t *, mcip,
                    struct dhcp *, dh4, uint8_t, mtype);
                return;
        }

        mutex_enter(&mcip->mci_protect_lock);
        if ((txn = find_dhcpv4_pending_txn(mcip, dh4->xid)) == NULL) {
                DTRACE_PROBE2(txn__not__found, mac_client_impl_t *, mcip,
                    struct dhcp *, dh4);
                goto done;
        }
        remove_dhcpv4_pending_txn(mcip, txn);

        /*
         * We're about to move a txn from the pending table to the completed/
         * dyn-ip tables. If there is an existing completed txn with the
         * same cid as our txn, we need to remove and free it.
         */
        ctxn = find_dhcpv4_completed_txn(mcip, txn->dt_cid, txn->dt_cid_len);
        if (ctxn != NULL) {
                DTRACE_PROBE2(replacing__old__txn, mac_client_impl_t *, mcip,
                    dhcpv4_txn_t *, ctxn);
                remove_dhcpv4_completed_txn(mcip, ctxn);
                free_dhcpv4_txn(ctxn);
        }
        if (mtype == NAK) {
                DTRACE_PROBE2(nak__received, mac_client_impl_t *, mcip,
                    dhcpv4_txn_t *, txn);
                free_dhcpv4_txn(txn);
                goto done;
        }
        if (insert_dhcpv4_completed_txn(mcip, txn) != 0) {
                DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
                    dhcpv4_txn_t *, txn);
                free_dhcpv4_txn(txn);
                goto done;
        }
        DTRACE_PROBE2(txn__completed, mac_client_impl_t *, mcip,
            dhcpv4_txn_t *, txn);

done:
        mutex_exit(&mcip->mci_protect_lock);
}


/*
 * Comparison functions for the DHCPv6 AVL trees.
 */
static int
compare_dhcpv6_xid(const void *arg1, const void *arg2)
{
        const dhcpv6_txn_t      *txn1 = arg1, *txn2 = arg2;

        if (txn1->dt_xid < txn2->dt_xid)
                return (-1);
        else if (txn1->dt_xid > txn2->dt_xid)
                return (1);
        else
                return (0);
}

static int
compare_dhcpv6_ip(const void *arg1, const void *arg2)
{
        const dhcpv6_addr_t     *ip1 = arg1, *ip2 = arg2;
        int                     ret;

        ret = memcmp(&ip1->da_addr, &ip2->da_addr, sizeof (in6_addr_t));
        if (ret < 0)
                return (-1);
        else if (ret > 0)
                return (1);
        else
                return (0);
}

static int
compare_dhcpv6_cid(const void *arg1, const void *arg2)
{
        const dhcpv6_cid_t      *cid1 = arg1, *cid2 = arg2;
        int                     ret;

        if (cid1->dc_cid_len < cid2->dc_cid_len)
                return (-1);
        else if (cid1->dc_cid_len > cid2->dc_cid_len)
                return (1);

        if (cid1->dc_cid_len == 0)
                return (0);

        ret = memcmp(cid1->dc_cid, cid2->dc_cid, cid1->dc_cid_len);
        if (ret < 0)
                return (-1);
        else if (ret > 0)
                return (1);
        else
                return (0);
}

static int
compare_slaac_ip(const void *arg1, const void *arg2)
{
        const slaac_addr_t      *ip1 = arg1, *ip2 = arg2;
        int                     ret;

        ret = memcmp(&ip1->sla_addr, &ip2->sla_addr, sizeof (in6_addr_t));
        if (ret < 0)
                return (-1);
        else if (ret > 0)
                return (1);
        else
                return (0);
}

/*
 * Locate the start of a DHCPv6 header.
 * The possible return values and associated meanings are:
 * 0      - packet is DHCP and has a DHCP header.
 * EINVAL - packet is not DHCP. the recommended action is to let it pass.
 * ENOSPC - packet is a initial fragment that is DHCP or is unidentifiable.
 *          the recommended action is to drop it.
 */
static int
get_dhcpv6_info(ip6_t *ip6h, uchar_t *end, dhcpv6_message_t **dh6)
{
        uint16_t        hdrlen, client, server;
        boolean_t       first_frag = B_FALSE;
        ip6_frag_t      *frag = NULL;
        uint8_t         proto;
        struct udphdr   *udph;
        uchar_t         *dh;

        if (!mac_ip_hdr_length_v6(ip6h, end, &hdrlen, &proto, &frag))
                return (ENOSPC);

        if (proto != IPPROTO_UDP)
                return (EINVAL);

        if (frag != NULL) {
                /*
                 * All non-initial fragments may pass because we cannot
                 * identify their type. It's safe to let them through
                 * because reassembly will fail if we decide to drop the
                 * initial fragment.
                 */
                if ((ntohs(frag->ip6f_offlg) & ~7) != 0)
                        return (EINVAL);
                first_frag = B_TRUE;
        }
        /* drop packets without a udp header */
        udph = (struct udphdr *)((uchar_t *)ip6h + hdrlen);
        if ((uchar_t *)&udph[1] > end)
                return (ENOSPC);

        client = htons(IPPORT_DHCPV6C);
        server = htons(IPPORT_DHCPV6S);
        if (udph->uh_sport != client && udph->uh_sport != server &&
            udph->uh_dport != client && udph->uh_dport != server)
                return (EINVAL);

        /* drop dhcp fragments */
        if (first_frag)
                return (ENOSPC);

        dh = (uchar_t *)&udph[1];
        if (dh + sizeof (dhcpv6_message_t) > end)
                return (EINVAL);

        *dh6 = (dhcpv6_message_t *)dh;
        return (0);
}

static int
get_ra_info(ip6_t *ip6h, uchar_t *end, nd_router_advert_t **ra)
{
        uint16_t                hdrlen;
        ip6_frag_t              *frag = NULL;
        uint8_t                 proto;
        uchar_t                 *hdrp;
        struct icmp6_hdr        *icmp;

        if (!mac_ip_hdr_length_v6(ip6h, end, &hdrlen, &proto, &frag))
                return (ENOSPC);

        if (proto != IPPROTO_ICMPV6)
                return (EINVAL);

        if (frag != NULL) {
                /*
                 * All non-initial fragments may pass because we cannot
                 * identify their type. It's safe to let them through
                 * because reassembly will fail if we decide to drop the
                 * initial fragment.
                 */
                if ((ntohs(frag->ip6f_offlg) & ~7) != 0)
                        return (EINVAL);
                return (ENOSPC);
        }

        /*
         * Ensure that the ICMP header falls w/in packet boundaries, in case
         * we've received a malicious packet that reports incorrect lengths.
         */
        hdrp = (uchar_t *)ip6h + hdrlen;
        if ((hdrp + sizeof (struct icmp6_hdr)) > end) {
                return (EINVAL);
        }
        icmp = (struct icmp6_hdr *)hdrp;

        if (icmp->icmp6_type != ND_ROUTER_ADVERT ||
            icmp->icmp6_code != 0)
                return (EINVAL);

        *ra = (nd_router_advert_t *)icmp;
        return (0);
}

/*
 * Find the specified DHCPv6 option.
 */
static dhcpv6_option_t *
get_dhcpv6_option(void *buf, size_t buflen, dhcpv6_option_t *oldopt,
    uint16_t codenum, uint_t *retlenp)
{
        uchar_t         *bp;
        dhcpv6_option_t d6o;
        uint_t          olen;

        codenum = htons(codenum);
        bp = buf;
        while (buflen >= sizeof (dhcpv6_option_t)) {
                bcopy(bp, &d6o, sizeof (d6o));
                olen = ntohs(d6o.d6o_len) + sizeof (d6o);
                if (olen > buflen)
                        break;
                if (d6o.d6o_code != codenum || d6o.d6o_len == 0 ||
                    (oldopt != NULL && bp <= (uchar_t *)oldopt)) {
                        bp += olen;
                        buflen -= olen;
                        continue;
                }
                if (retlenp != NULL)
                        *retlenp = olen;
                /* LINTED : alignment */
                return ((dhcpv6_option_t *)bp);
        }
        return (NULL);
}

/*
 * Get the status code from a reply message.
 */
static int
get_dhcpv6_status(dhcpv6_message_t *dh6, uchar_t *end, uint16_t *status)
{
        dhcpv6_option_t *d6o;
        uint_t          olen;
        uint16_t        s;

        d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
            DHCPV6_OPT_STATUS_CODE, &olen);

        /* Success is implied if status code is missing */
        if (d6o == NULL) {
                *status = DHCPV6_STAT_SUCCESS;
                return (0);
        }
        if ((uchar_t *)d6o + olen > end)
                return (EINVAL);

        olen -= sizeof (*d6o);
        if (olen < sizeof (s))
                return (EINVAL);

        bcopy(&d6o[1], &s, sizeof (s));
        *status = ntohs(s);
        return (0);
}

/*
 * Get the addresses from a reply message.
 */
static int
get_dhcpv6_addrs(dhcpv6_message_t *dh6, uchar_t *end, dhcpv6_cid_t *cid)
{
        dhcpv6_option_t         *d6o;
        dhcpv6_addr_t           *next;
        uint_t                  olen;

        d6o = NULL;
        while ((d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1],
            d6o, DHCPV6_OPT_IA_NA, &olen)) != NULL) {
                dhcpv6_option_t         *d6so;
                dhcpv6_iaaddr_t         d6ia;
                dhcpv6_addr_t           **addrp;
                uchar_t                 *obase;
                uint_t                  solen;

                if (olen < sizeof (dhcpv6_ia_na_t) ||
                    (uchar_t *)d6o + olen > end)
                        goto fail;

                obase = (uchar_t *)d6o + sizeof (dhcpv6_ia_na_t);
                olen -= sizeof (dhcpv6_ia_na_t);
                d6so = NULL;
                while ((d6so = get_dhcpv6_option(obase, olen, d6so,
                    DHCPV6_OPT_IAADDR, &solen)) != NULL) {
                        if (solen < sizeof (dhcpv6_iaaddr_t) ||
                            (uchar_t *)d6so + solen > end)
                                goto fail;

                        bcopy(d6so, &d6ia, sizeof (d6ia));
                        for (addrp = &cid->dc_addr; *addrp != NULL;
                            addrp = &(*addrp)->da_next) {
                                if (bcmp(&(*addrp)->da_addr, &d6ia.d6ia_addr,
                                    sizeof (in6_addr_t)) == 0)
                                        goto fail;
                        }
                        if ((*addrp = kmem_zalloc(sizeof (dhcpv6_addr_t),
                            KM_NOSLEEP)) == NULL)
                                goto fail;

                        bcopy(&d6ia.d6ia_addr, &(*addrp)->da_addr,
                            sizeof (in6_addr_t));
                        cid->dc_addrcnt++;
                }
        }
        if (cid->dc_addrcnt == 0)
                return (ENOENT);

        return (0);

fail:
        for (; cid->dc_addr != NULL; cid->dc_addr = next) {
                next = cid->dc_addr->da_next;
                kmem_free(cid->dc_addr, sizeof (dhcpv6_addr_t));
                cid->dc_addrcnt--;
        }
        ASSERT(cid->dc_addrcnt == 0);
        return (EINVAL);
}

/*
 * Free a cid.
 * Before this gets called the caller must ensure that all the
 * addresses are removed from the mci_v6_dyn_ip table.
 */
static void
free_dhcpv6_cid(dhcpv6_cid_t *cid)
{
        dhcpv6_addr_t   *addr, *next;
        uint_t          cnt = 0;

        kmem_free(cid->dc_cid, cid->dc_cid_len);
        for (addr = cid->dc_addr; addr != NULL; addr = next) {
                next = addr->da_next;
                kmem_free(addr, sizeof (*addr));
                cnt++;
        }
        ASSERT(cnt == cid->dc_addrcnt);
        kmem_free(cid, sizeof (*cid));
}

/*
 * Extract the DUID from a message. The associated addresses will be
 * extracted later from the reply message.
 */
static dhcpv6_cid_t *
create_dhcpv6_cid(dhcpv6_message_t *dh6, uchar_t *end)
{
        dhcpv6_option_t         *d6o;
        dhcpv6_cid_t            *cid;
        uchar_t                 *rawcid;
        uint_t                  olen, rawcidlen;

        d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
            DHCPV6_OPT_CLIENTID, &olen);
        if (d6o == NULL || (uchar_t *)d6o + olen > end)
                return (NULL);

        rawcidlen = olen - sizeof (*d6o);
        if ((rawcid = kmem_zalloc(rawcidlen, KM_NOSLEEP)) == NULL)
                return (NULL);
        bcopy(d6o + 1, rawcid, rawcidlen);

        if ((cid = kmem_zalloc(sizeof (*cid), KM_NOSLEEP)) == NULL) {
                kmem_free(rawcid, rawcidlen);
                return (NULL);
        }
        cid->dc_cid = rawcid;
        cid->dc_cid_len = rawcidlen;
        return (cid);
}

/*
 * Remove a cid from mci_v6_cid. The addresses owned by the cid
 * are also removed from mci_v6_dyn_ip.
 */
static void
remove_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
{
        dhcpv6_addr_t   *addr, *tmp_addr;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        avl_remove(&mcip->mci_v6_cid, cid);
        for (addr = cid->dc_addr; addr != NULL; addr = addr->da_next) {
                tmp_addr = avl_find(&mcip->mci_v6_dyn_ip, addr, NULL);
                if (tmp_addr == addr)
                        avl_remove(&mcip->mci_v6_dyn_ip, addr);
        }
}

/*
 * Find and remove a matching cid and associated addresses from
 * their respective tables.
 */
static void
release_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
{
        dhcpv6_cid_t    *oldcid;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        if ((oldcid = avl_find(&mcip->mci_v6_cid, cid, NULL)) == NULL)
                return;

        /*
         * Since cid belongs to a pending txn, it can't possibly be in
         * mci_v6_cid. Anything that's found must be an existing cid.
         */
        ASSERT(oldcid != cid);
        remove_dhcpv6_cid(mcip, oldcid);
        free_dhcpv6_cid(oldcid);
}

/*
 * Insert cid into mci_v6_cid.
 */
static int
insert_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
{
        avl_index_t     where;
        dhcpv6_addr_t   *addr;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        if (avl_find(&mcip->mci_v6_cid, cid, &where) != NULL)
                return (EEXIST);

        if (avl_numnodes(&mcip->mci_v6_cid) >= dhcp_max_completed_txn) {
                BUMP_STAT(mcip, dhcpdropped);
                return (EAGAIN);
        }
        avl_insert(&mcip->mci_v6_cid, cid, where);
        for (addr = cid->dc_addr; addr != NULL; addr = addr->da_next) {
                if (avl_find(&mcip->mci_v6_dyn_ip, addr, &where) != NULL)
                        goto fail;

                avl_insert(&mcip->mci_v6_dyn_ip, addr, where);
        }
        return (0);

fail:
        remove_dhcpv6_cid(mcip, cid);
        return (EEXIST);
}

/*
 * Check whether an IP address is in the dyn-ip table.
 */
static boolean_t
check_dhcpv6_dyn_ip(mac_client_impl_t *mcip, in6_addr_t *addr)
{
        dhcpv6_addr_t   tmp_addr, *a;

        mutex_enter(&mcip->mci_protect_lock);
        bcopy(addr, &tmp_addr.da_addr, sizeof (in6_addr_t));
        a = avl_find(&mcip->mci_v6_dyn_ip, &tmp_addr, NULL);
        mutex_exit(&mcip->mci_protect_lock);
        return (a != NULL);
}

static dhcpv6_txn_t *
find_dhcpv6_pending_txn(mac_client_impl_t *mcip, uint32_t xid)
{
        dhcpv6_txn_t    tmp_txn;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        tmp_txn.dt_xid = xid;
        return (avl_find(&mcip->mci_v6_pending_txn, &tmp_txn, NULL));
}

static void
remove_dhcpv6_pending_txn(mac_client_impl_t *mcip, dhcpv6_txn_t *txn)
{
        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        avl_remove(&mcip->mci_v6_pending_txn, txn);
}

static dhcpv6_txn_t *
create_dhcpv6_txn(uint32_t xid, dhcpv6_cid_t *cid)
{
        dhcpv6_txn_t    *txn;

        if ((txn = kmem_zalloc(sizeof (dhcpv6_txn_t), KM_NOSLEEP)) == NULL)
                return (NULL);

        txn->dt_xid = xid;
        txn->dt_cid = cid;
        txn->dt_timestamp = gethrtime();
        return (txn);
}

static void
free_dhcpv6_txn(dhcpv6_txn_t *txn)
{
        if (txn->dt_cid != NULL)
                free_dhcpv6_cid(txn->dt_cid);
        kmem_free(txn, sizeof (dhcpv6_txn_t));
}

static int
insert_dhcpv6_pending_txn(mac_client_impl_t *mcip, dhcpv6_txn_t *txn)
{
        avl_index_t     where;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        if (avl_find(&mcip->mci_v6_pending_txn, txn, &where) != NULL)
                return (EEXIST);

        if (avl_numnodes(&mcip->mci_v6_pending_txn) >= dhcp_max_pending_txn) {
                BUMP_STAT(mcip, dhcpdropped);
                return (EAGAIN);
        }
        avl_insert(&mcip->mci_v6_pending_txn, txn, where);
        return (0);
}

/*
 * Clean up all v6 tables.
 */
static void
flush_dhcpv6(mac_client_impl_t *mcip)
{
        void            *cookie = NULL;
        dhcpv6_cid_t    *cid;
        dhcpv6_txn_t    *txn;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        while (avl_destroy_nodes(&mcip->mci_v6_dyn_ip, &cookie) != NULL) {
        }
        cookie = NULL;
        while ((cid = avl_destroy_nodes(&mcip->mci_v6_cid, &cookie)) != NULL) {
                free_dhcpv6_cid(cid);
        }
        cookie = NULL;
        while ((txn = avl_destroy_nodes(&mcip->mci_v6_pending_txn,
            &cookie)) != NULL) {
                free_dhcpv6_txn(txn);
        }
}

void
flush_slaac(mac_client_impl_t *mcip)
{
        void            *cookie = NULL;
        slaac_addr_t    *addr = NULL;

        while ((addr = avl_destroy_nodes(&mcip->mci_v6_slaac_ip, &cookie)) !=
            NULL) {
                kmem_free(addr, sizeof (slaac_addr_t));
        }
}

/*
 * Cleanup stale DHCPv6 transactions.
 */
static void
txn_cleanup_v6(mac_client_impl_t *mcip)
{
        dhcpv6_txn_t            *txn, *next, *txn_list = NULL;

        /*
         * Find stale pending transactions and place them on a list
         * to be removed.
         */
        for (txn = avl_first(&mcip->mci_v6_pending_txn); txn != NULL;
            txn = avl_walk(&mcip->mci_v6_pending_txn, txn, AVL_AFTER)) {
                if (gethrtime() - txn->dt_timestamp > txn_cleanup_interval) {
                        DTRACE_PROBE2(found__expired__txn,
                            mac_client_impl_t *, mcip,
                            dhcpv6_txn_t *, txn);

                        txn->dt_next = txn_list;
                        txn_list = txn;
                }
        }

        /*
         * Remove and free stale pending transactions.
         * Release any existing cids matching the stale transactions.
         */
        for (txn = txn_list; txn != NULL; txn = next) {
                avl_remove(&mcip->mci_v6_pending_txn, txn);
                release_dhcpv6_cid(mcip, txn->dt_cid);
                next = txn->dt_next;
                txn->dt_next = NULL;

                DTRACE_PROBE2(freeing__txn, mac_client_impl_t *, mcip,
                    dhcpv6_txn_t *, txn);
                free_dhcpv6_txn(txn);
        }

}

/*
 * Core logic for intercepting outbound DHCPv6 packets.
 */
static boolean_t
intercept_dhcpv6_outbound(mac_client_impl_t *mcip, ip6_t *ip6h, uchar_t *end)
{
        dhcpv6_message_t        *dh6;
        dhcpv6_txn_t            *txn;
        dhcpv6_cid_t            *cid = NULL;
        uint32_t                xid;
        uint8_t                 mtype;
        mac_resource_props_t *mrp = MCIP_RESOURCE_PROPS(mcip);

        if (get_dhcpv6_info(ip6h, end, &dh6) != 0)
                return (B_TRUE);

        /* ip_nospoof/allowed-ips and DHCP are mutually exclusive by default */
        if (allowed_ips_set(mrp, IPV6_VERSION))
                return (B_FALSE);

        /*
         * We want to act on packets that result in DHCPv6 Reply messages, or
         * on packets that give up an IPv6 address. For example, a Request or
         * Solicit (w/ the Rapid Commit option) will cause the server to send a
         * Reply, ending the transaction.
         */
        mtype = dh6->d6m_msg_type;
        if (mtype != DHCPV6_MSG_SOLICIT && mtype != DHCPV6_MSG_REQUEST &&
            mtype != DHCPV6_MSG_RENEW && mtype != DHCPV6_MSG_REBIND &&
            mtype != DHCPV6_MSG_RELEASE)
                return (B_TRUE);

        if ((cid = create_dhcpv6_cid(dh6, end)) == NULL)
                return (B_TRUE);

        mutex_enter(&mcip->mci_protect_lock);
        if (mtype == DHCPV6_MSG_RELEASE) {
                release_dhcpv6_cid(mcip, cid);
                goto done;
        }
        xid = DHCPV6_GET_TRANSID(dh6);
        if ((txn = find_dhcpv6_pending_txn(mcip, xid)) != NULL) {
                DTRACE_PROBE2(update, mac_client_impl_t *, mcip,
                    dhcpv6_txn_t *, txn);
                txn->dt_timestamp = gethrtime();
                goto done;
        }
        if ((txn = create_dhcpv6_txn(xid, cid)) == NULL)
                goto done;

        cid = NULL;
        if (insert_dhcpv6_pending_txn(mcip, txn) != 0) {
                DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
                    dhcpv6_txn_t *, txn);
                free_dhcpv6_txn(txn);
                goto done;
        }
        start_txn_cleanup_timer(mcip);

        DTRACE_PROBE2(txn__pending, mac_client_impl_t *, mcip,
            dhcpv6_txn_t *, txn);

done:
        if (cid != NULL)
                free_dhcpv6_cid(cid);

        mutex_exit(&mcip->mci_protect_lock);
        return (B_TRUE);
}

/*
 * Core logic for intercepting inbound DHCPv6 packets.
 */
static void
intercept_dhcpv6_inbound(mac_client_impl_t *mcip, uchar_t *end,
    dhcpv6_message_t *dh6)
{
        dhcpv6_txn_t            *txn;
        uint32_t                xid;
        uint8_t                 mtype;
        uint16_t                status;

        mtype = dh6->d6m_msg_type;
        if (mtype != DHCPV6_MSG_REPLY)
                return;

        mutex_enter(&mcip->mci_protect_lock);
        xid = DHCPV6_GET_TRANSID(dh6);
        if ((txn = find_dhcpv6_pending_txn(mcip, xid)) == NULL) {
                DTRACE_PROBE2(txn__not__found, mac_client_impl_t *, mcip,
                    dhcpv6_message_t *, dh6);
                goto done;
        }
        remove_dhcpv6_pending_txn(mcip, txn);
        release_dhcpv6_cid(mcip, txn->dt_cid);

        if (get_dhcpv6_status(dh6, end, &status) != 0 ||
            status != DHCPV6_STAT_SUCCESS) {
                DTRACE_PROBE2(error__status, mac_client_impl_t *, mcip,
                    dhcpv6_txn_t *, txn);
                goto done;
        }
        if (get_dhcpv6_addrs(dh6, end, txn->dt_cid) != 0) {
                DTRACE_PROBE2(no__addrs, mac_client_impl_t *, mcip,
                    dhcpv6_txn_t *, txn);
                goto done;
        }
        if (insert_dhcpv6_cid(mcip, txn->dt_cid) != 0) {
                DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
                    dhcpv6_txn_t *, txn);
                goto done;
        }
        DTRACE_PROBE2(txn__completed, mac_client_impl_t *, mcip,
            dhcpv6_txn_t *, txn);

        txn->dt_cid = NULL;

done:
        if (txn != NULL)
                free_dhcpv6_txn(txn);
        mutex_exit(&mcip->mci_protect_lock);
}

/*
 * Check whether an IP address is in the SLAAC table.
 */
static boolean_t
check_slaac_ip(mac_client_impl_t *mcip, in6_addr_t *addr)
{
        slaac_addr_t    tmp_addr, *a;

        mutex_enter(&mcip->mci_protect_lock);
        bcopy(addr, &tmp_addr.sla_addr, sizeof (in6_addr_t));
        a = avl_find(&mcip->mci_v6_slaac_ip, &tmp_addr, NULL);
        mutex_exit(&mcip->mci_protect_lock);
        return (a != NULL);
}

static boolean_t
insert_slaac_ip(avl_tree_t *tree, in6_addr_t *token, slaac_addr_t *addr)
{
        uint_t          i;
        avl_index_t     where;
        in6_addr_t      *prefix = &addr->sla_prefix;
        in6_addr_t      *in6p = &addr->sla_addr;

        bcopy(prefix, in6p, sizeof (struct in6_addr));

        for (i = 0; i < 4; i++) {
                in6p->s6_addr32[i] = token->s6_addr32[i] |
                    in6p->s6_addr32[i];
        }

        DTRACE_PROBE1(generated__addr, in6_addr_t *, in6p);

        if (avl_find(tree, addr, &where) != NULL)
                return (B_FALSE);

        avl_insert(tree, addr, where);
        return (B_TRUE);
}

static void
insert_slaac_prefix(mac_client_impl_t *mcip, nd_opt_prefix_info_t *po)
{
        slaac_addr_t    *addr = NULL;
        in6_addr_t      *token = &mcip->mci_v6_mac_token;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));

        if (avl_numnodes(&mcip->mci_v6_slaac_ip) >= slaac_max_allowed) {
                DTRACE_PROBE(limit__reached);
                return;
        }

        if ((addr = kmem_zalloc(sizeof (slaac_addr_t),
            KM_NOSLEEP | KM_NORMALPRI)) == NULL)
                return;

        bcopy(&po->nd_opt_pi_prefix, &addr->sla_prefix,
            sizeof (struct in6_addr));

        if (!insert_slaac_ip(&mcip->mci_v6_slaac_ip, token, addr)) {
                kmem_free(addr, sizeof (slaac_addr_t));
        }
}

static void
intercept_prefix_info(mac_client_impl_t *mcip, nd_opt_prefix_info_t *po)
{
        if (8 * po->nd_opt_pi_len != sizeof (nd_opt_prefix_info_t)) {
                DTRACE_PROBE(invalid__length);
                return;
        }

        if (po->nd_opt_pi_prefix_len > 128) {
                DTRACE_PROBE(invalid__plen);
                return;
        }

        if (IN6_IS_ADDR_LINKLOCAL(&po->nd_opt_pi_prefix)) {
                DTRACE_PROBE(link__local);
                return;
        }

        if ((po->nd_opt_pi_flags_reserved & ND_OPT_PI_FLAG_AUTO) == 0)
                return;

        mutex_enter(&mcip->mci_protect_lock);
        insert_slaac_prefix(mcip, po);
        mutex_exit(&mcip->mci_protect_lock);
}

/*
 * If we receive a Router Advertisement carrying prefix information and
 * indicating that SLAAC should be performed, then track the prefix.
 */
static void
intercept_ra_inbound(mac_client_impl_t *mcip, ip6_t *ip6h, uchar_t *end,
    nd_router_advert_t *ra)
{
        struct nd_opt_hdr *opt;
        int len, optlen;

        if (ip6h->ip6_hlim != 255) {
                DTRACE_PROBE1(invalid__hoplimit, uint8_t, ip6h->ip6_hlim);
                return;
        }

        len = ip6h->ip6_plen - sizeof (nd_router_advert_t);
        opt = (struct nd_opt_hdr *)&ra[1];
        while (len >= sizeof (struct nd_opt_hdr) &&
            ((uchar_t *)opt + sizeof (struct nd_opt_hdr)) <= end) {
                optlen = opt->nd_opt_len * 8;

                if (optlen < sizeof (struct nd_opt_hdr) ||
                    ((uchar_t *)opt + optlen) > end) {
                        DTRACE_PROBE(invalid__length);
                        return;
                }

                if (opt->nd_opt_type == ND_OPT_PREFIX_INFORMATION) {
                        intercept_prefix_info(mcip,
                            (nd_opt_prefix_info_t *)opt);
                }

                opt = (struct nd_opt_hdr *)((char *)opt + optlen);
                len -= optlen;
        }
}

/*
 * Timer for cleaning up stale transactions.
 */
static void
txn_cleanup_timer(void *arg)
{
        mac_client_impl_t       *mcip = arg;

        mutex_enter(&mcip->mci_protect_lock);
        if (mcip->mci_txn_cleanup_tid == 0) {
                /* do nothing if timer got cancelled */
                mutex_exit(&mcip->mci_protect_lock);
                return;
        }
        mcip->mci_txn_cleanup_tid = 0;

        txn_cleanup_v4(mcip);
        txn_cleanup_v6(mcip);

        /*
         * Restart timer if pending transactions still exist.
         */
        if (!avl_is_empty(&mcip->mci_v4_pending_txn) ||
            !avl_is_empty(&mcip->mci_v6_pending_txn)) {
                DTRACE_PROBE1(restarting__timer, mac_client_impl_t *, mcip);

                mcip->mci_txn_cleanup_tid = timeout(txn_cleanup_timer, mcip,
                    drv_usectohz(txn_cleanup_interval / (NANOSEC / MICROSEC)));
        }
        mutex_exit(&mcip->mci_protect_lock);
}

static void
start_txn_cleanup_timer(mac_client_impl_t *mcip)
{
        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
        if (mcip->mci_txn_cleanup_tid == 0) {
                mcip->mci_txn_cleanup_tid = timeout(txn_cleanup_timer, mcip,
                    drv_usectohz(txn_cleanup_interval / (NANOSEC / MICROSEC)));
        }
}

static void
cancel_txn_cleanup_timer(mac_client_impl_t *mcip)
{
        timeout_id_t    tid;

        ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));

        /*
         * This needs to be a while loop because the timer could get
         * rearmed during untimeout().
         */
        while ((tid = mcip->mci_txn_cleanup_tid) != 0) {
                mcip->mci_txn_cleanup_tid = 0;
                mutex_exit(&mcip->mci_protect_lock);
                (void) untimeout(tid);
                mutex_enter(&mcip->mci_protect_lock);
        }
}

/*
 * Get the start/end pointers of an L3 packet and also do pullup if needed.
 * pulled-up packet needs to be freed by the caller.
 */
static int
get_l3_info(mblk_t *mp, size_t hdrsize, uchar_t **start, uchar_t **end,
    mblk_t **nmp)
{
        uchar_t *s, *e;
        mblk_t  *newmp = NULL;

        /*
         * Pullup if necessary but reject packets that do not have
         * a proper mac header.
         */
        s = mp->b_rptr + hdrsize;
        e = mp->b_wptr;

        if (s > mp->b_wptr)
                return (EINVAL);

        if (!OK_32PTR(s) || mp->b_cont != NULL) {
                /*
                 * Temporarily adjust mp->b_rptr to ensure proper
                 * alignment of IP header in newmp.
                 */
                DTRACE_PROBE1(pullup__needed, mblk_t *, mp);

                mp->b_rptr += hdrsize;
                newmp = msgpullup(mp, -1);
                mp->b_rptr -= hdrsize;

                if (newmp == NULL)
                        return (ENOMEM);

                s = newmp->b_rptr;
                e = newmp->b_wptr;
        }

        *start = s;
        *end = e;
        *nmp = newmp;
        return (0);
}

void
mac_protect_intercept_dynamic_one(mac_client_impl_t *mcip, mblk_t *mp)
{
        mac_impl_t              *mip = mcip->mci_mip;
        uchar_t                 *start, *end;
        mblk_t                  *nmp = NULL;
        mac_header_info_t       mhi;
        int                     err;

        err = mac_vlan_header_info((mac_handle_t)mip, mp, &mhi);
        if (err != 0) {
                DTRACE_PROBE2(invalid__header, mac_client_impl_t *, mcip,
                    mblk_t *, mp);
                return;
        }

        err = get_l3_info(mp, mhi.mhi_hdrsize, &start, &end, &nmp);
        if (err != 0) {
                DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
                    mblk_t *, mp);
                return;
        }

        switch (mhi.mhi_bindsap) {
        case ETHERTYPE_IP: {
                struct dhcp     *dh4;
                ipha_t          *ipha = (ipha_t *)start;

                if (start + sizeof (ipha_t) > end)
                        return;

                if (get_dhcpv4_info(ipha, end, &dh4) == 0) {
                        intercept_dhcpv4_inbound(mcip, end, dh4);
                }
                break;
        }
        case ETHERTYPE_IPV6: {
                dhcpv6_message_t        *dh6;
                nd_router_advert_t      *ra;
                ip6_t                   *ip6h = (ip6_t *)start;

                if (start + sizeof (ip6_t) > end)
                        return;

                if (get_dhcpv6_info(ip6h, end, &dh6) == 0) {
                        intercept_dhcpv6_inbound(mcip, end, dh6);
                } else if (get_ra_info(ip6h, end, &ra) == 0) {
                        intercept_ra_inbound(mcip, ip6h, end, ra);
                }

                break;
        }
        }
        freemsg(nmp);
}

void
mac_protect_intercept_dynamic(mac_client_impl_t *mcip, mblk_t *mp)
{
        /*
         * Skip checks if we are part of an aggr.
         */
        if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) != 0)
                return;

        for (; mp != NULL; mp = mp->b_next)
                mac_protect_intercept_dynamic_one(mcip, mp);
}

void
mac_protect_flush_dynamic(mac_client_impl_t *mcip)
{
        mutex_enter(&mcip->mci_protect_lock);
        flush_dhcpv4(mcip);
        flush_dhcpv6(mcip);
        flush_slaac(mcip);
        mutex_exit(&mcip->mci_protect_lock);
}

void
mac_protect_cancel_timer(mac_client_impl_t *mcip)
{
        mutex_enter(&mcip->mci_protect_lock);
        cancel_txn_cleanup_timer(mcip);
        mutex_exit(&mcip->mci_protect_lock);
}

/*
 * Check if addr is in the 'allowed-ips' list.
 */

/* ARGSUSED */
static boolean_t
ipnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *protect,
    ipaddr_t *addr)
{
        uint_t  i;

        /*
         * The unspecified address is allowed.
         */
        if (*addr == INADDR_ANY)
                return (B_TRUE);

        for (i = 0; i < protect->mp_ipaddrcnt; i++) {
                mac_ipaddr_t    *v4addr = &protect->mp_ipaddrs[i];

                if (v4addr->ip_version == IPV4_VERSION) {
                        uint32_t mask;

                        /* LINTED E_SUSPICIOUS_COMPARISON */
                        ASSERT(v4addr->ip_netmask >= 0 &&
                            v4addr->ip_netmask <= 32);
                        mask = 0xFFFFFFFFu << (32 - v4addr->ip_netmask);
                        /*
                         * Since we have a netmask we know this entry
                         * signifies the entire subnet. Check if the
                         * given address is on the subnet.
                         */
                        if (htonl(V4_PART_OF_V6(v4addr->ip_addr)) ==
                            (htonl(*addr) & mask))
                                return (B_TRUE);
                }
        }
        return (protect->mp_ipaddrcnt == 0 ?
            check_dhcpv4_dyn_ip(mcip, *addr) : B_FALSE);
}

static boolean_t
ipnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *protect,
    in6_addr_t *addr)
{
        uint_t  i;

        /*
         * The unspecified address and the v6 link local address are allowed.
         */
        if (IN6_IS_ADDR_UNSPECIFIED(addr) ||
            ((mcip->mci_protect_flags & MPT_FLAG_V6_LOCAL_ADDR_SET) != 0 &&
            IN6_ARE_ADDR_EQUAL(&mcip->mci_v6_local_addr, addr)))
                return (B_TRUE);


        for (i = 0; i < protect->mp_ipaddrcnt; i++) {
                mac_ipaddr_t    *v6addr = &protect->mp_ipaddrs[i];

                if (v6addr->ip_version == IPV6_VERSION &&
                    /* LINTED E_SUSPICIOUS_COMPARISON */
                    IN6_ARE_PREFIXEDADDR_EQUAL(&v6addr->ip_addr, addr,
                    v6addr->ip_netmask))
                        return (B_TRUE);
        }

        if (protect->mp_ipaddrcnt == 0) {
                return (check_slaac_ip(mcip, addr) ||
                    check_dhcpv6_dyn_ip(mcip, addr));
        } else {
                return (B_FALSE);
        }
}

/*
 * Checks various fields within an IPv6 NDP packet.
 */
static boolean_t
ipnospoof_check_ndp(mac_client_impl_t *mcip, mac_protect_t *protect,
    ip6_t *ip6h, uchar_t *end)
{
        icmp6_t                 *icmp_nd = (icmp6_t *)&ip6h[1];
        int                     hdrlen, optlen, opttype, len;
        uint_t                  addrlen, maclen;
        uint8_t                 type;
        nd_opt_hdr_t            *opt;
        struct nd_opt_lla       *lla = NULL;

        /*
         * NDP packets do not have extension headers so the ICMPv6 header
         * must immediately follow the IPv6 header.
         */
        if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
                return (B_TRUE);

        /* ICMPv6 header missing */
        if ((uchar_t *)&icmp_nd[1] > end)
                return (B_FALSE);

        len = end - (uchar_t *)icmp_nd;
        type = icmp_nd->icmp6_type;

        switch (type) {
        case ND_ROUTER_SOLICIT:
                hdrlen = sizeof (nd_router_solicit_t);
                break;
        case ND_ROUTER_ADVERT:
                hdrlen = sizeof (nd_router_advert_t);
                break;
        case ND_NEIGHBOR_SOLICIT:
                hdrlen = sizeof (nd_neighbor_solicit_t);
                break;
        case ND_NEIGHBOR_ADVERT:
                hdrlen = sizeof (nd_neighbor_advert_t);
                break;
        case ND_REDIRECT:
                hdrlen = sizeof (nd_redirect_t);
                break;
        default:
                return (B_TRUE);
        }

        if (len < hdrlen)
                return (B_FALSE);

        /* SLLA option checking is needed for RS/RA/NS */
        opttype = ND_OPT_SOURCE_LINKADDR;

        switch (type) {
        case ND_NEIGHBOR_ADVERT: {
                nd_neighbor_advert_t    *na = (nd_neighbor_advert_t *)icmp_nd;

                if (!ipnospoof_check_v6(mcip, protect, &na->nd_na_target)) {
                        DTRACE_PROBE2(ndp__na__fail,
                            mac_client_impl_t *, mcip, ip6_t *, ip6h);
                        return (B_FALSE);
                }

                /* TLLA option for NA */
                opttype = ND_OPT_TARGET_LINKADDR;
                break;
        }
        case ND_REDIRECT: {
                /* option checking not needed for RD */
                return (B_TRUE);
        }
        default:
                break;
        }

        if (len == hdrlen) {
                /* no options, we're done */
                return (B_TRUE);
        }
        opt = (nd_opt_hdr_t *)((uchar_t *)icmp_nd + hdrlen);
        optlen = len - hdrlen;

        /* find the option header we need */
        while (optlen > sizeof (nd_opt_hdr_t)) {
                if (opt->nd_opt_type == opttype) {
                        lla = (struct nd_opt_lla *)opt;
                        break;
                }
                optlen -= 8 * opt->nd_opt_len;
                opt = (nd_opt_hdr_t *)
                    ((uchar_t *)opt + 8 * opt->nd_opt_len);
        }
        if (lla == NULL)
                return (B_TRUE);

        addrlen = lla->nd_opt_lla_len * 8 - sizeof (nd_opt_hdr_t);
        maclen = mcip->mci_mip->mi_info.mi_addr_length;

        if (addrlen != maclen ||
            bcmp(mcip->mci_unicast->ma_addr,
            lla->nd_opt_lla_hdw_addr, maclen) != 0) {
                DTRACE_PROBE2(ndp__lla__fail,
                    mac_client_impl_t *, mcip, ip6_t *, ip6h);
                return (B_FALSE);
        }

        DTRACE_PROBE2(ndp__lla__ok, mac_client_impl_t *, mcip, ip6_t *, ip6h);
        return (B_TRUE);
}

/*
 * Enforce ip-nospoof protection.
 */
static int
ipnospoof_check(mac_client_impl_t *mcip, mac_protect_t *protect,
    mblk_t *mp, mac_header_info_t *mhip)
{
        size_t          hdrsize = mhip->mhi_hdrsize;
        uint32_t        sap = mhip->mhi_bindsap;
        uchar_t         *start, *end;
        mblk_t          *nmp = NULL;
        int             err;

        err = get_l3_info(mp, hdrsize, &start, &end, &nmp);
        if (err != 0) {
                DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
                    mblk_t *, mp);
                return (err);
        }
        err = EINVAL;

        switch (sap) {
        case ETHERTYPE_IP: {
                ipha_t  *ipha = (ipha_t *)start;

                if (start + sizeof (ipha_t) > end)
                        goto fail;

                if (!ipnospoof_check_v4(mcip, protect, &ipha->ipha_src))
                        goto fail;

                if (!intercept_dhcpv4_outbound(mcip, ipha, end))
                        goto fail;
                break;
        }
        case ETHERTYPE_ARP: {
                arh_t           *arh = (arh_t *)start;
                uint32_t        maclen, hlen, plen, arplen;
                ipaddr_t        spaddr;
                uchar_t         *shaddr;

                if (start + sizeof (arh_t) > end)
                        goto fail;

                maclen = mcip->mci_mip->mi_info.mi_addr_length;
                hlen = arh->arh_hlen;
                plen = arh->arh_plen;
                if ((hlen != 0 && hlen != maclen) ||
                    plen != sizeof (ipaddr_t))
                        goto fail;

                arplen = sizeof (arh_t) + 2 * hlen + 2 * plen;
                if (start + arplen > end)
                        goto fail;

                shaddr = start + sizeof (arh_t);
                if (hlen != 0 &&
                    bcmp(mcip->mci_unicast->ma_addr, shaddr, maclen) != 0)
                        goto fail;

                bcopy(shaddr + hlen, &spaddr, sizeof (spaddr));
                if (!ipnospoof_check_v4(mcip, protect, &spaddr))
                        goto fail;
                break;
        }
        case ETHERTYPE_IPV6: {
                ip6_t           *ip6h = (ip6_t *)start;

                if (start + sizeof (ip6_t) > end)
                        goto fail;

                if (!ipnospoof_check_v6(mcip, protect, &ip6h->ip6_src))
                        goto fail;

                if (!ipnospoof_check_ndp(mcip, protect, ip6h, end))
                        goto fail;

                if (!intercept_dhcpv6_outbound(mcip, ip6h, end))
                        goto fail;
                break;
        }
        }
        freemsg(nmp);
        return (0);

fail:
        freemsg(nmp);
        return (err);
}

static boolean_t
dhcpnospoof_check_cid(mac_protect_t *p, uchar_t *cid, uint_t cidlen)
{
        int     i;

        for (i = 0; i < p->mp_cidcnt; i++) {
                mac_dhcpcid_t   *dcid = &p->mp_cids[i];

                if (dcid->dc_len == cidlen &&
                    bcmp(dcid->dc_id, cid, cidlen) == 0)
                        return (B_TRUE);
        }
        return (B_FALSE);
}

static boolean_t
dhcpnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *p,
    ipha_t *ipha, uchar_t *end)
{
        struct dhcp     *dh4;
        uchar_t         *cid;
        uint_t          maclen, cidlen = 0;
        uint8_t         optlen;
        int             err;

        if ((err = get_dhcpv4_info(ipha, end, &dh4)) != 0)
                return (err == EINVAL);

        maclen = mcip->mci_mip->mi_info.mi_addr_length;
        if (dh4->hlen == maclen &&
            bcmp(mcip->mci_unicast->ma_addr, dh4->chaddr, maclen) != 0) {
                return (B_FALSE);
        }
        if (get_dhcpv4_option(dh4, end, CD_CLIENT_ID, &cid, &optlen) == 0)
                cidlen = optlen;

        if (cidlen == 0)
                return (B_TRUE);

        if (*cid == ARPHRD_ETHER && cidlen - 1 == maclen &&
            bcmp(mcip->mci_unicast->ma_addr, cid + 1, maclen) == 0)
                return (B_TRUE);

        return (dhcpnospoof_check_cid(p, cid, cidlen));
}

static boolean_t
dhcpnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *p,
    ip6_t *ip6h, uchar_t *end)
{
        dhcpv6_message_t        *dh6;
        dhcpv6_option_t         *d6o;
        uint8_t                 mtype;
        uchar_t                 *cid, *lladdr = NULL;
        uint_t                  cidlen, maclen, addrlen = 0;
        uint16_t                cidtype;
        int                     err;

        if ((err = get_dhcpv6_info(ip6h, end, &dh6)) != 0)
                return (err == EINVAL);

        /*
         * We only check client-generated messages.
         */
        mtype = dh6->d6m_msg_type;
        if (mtype == DHCPV6_MSG_ADVERTISE || mtype == DHCPV6_MSG_REPLY ||
            mtype == DHCPV6_MSG_RECONFIGURE)
                return (B_TRUE);

        d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
            DHCPV6_OPT_CLIENTID, &cidlen);
        if (d6o == NULL || (uchar_t *)d6o + cidlen > end)
                return (B_TRUE);

        cid = (uchar_t *)&d6o[1];
        cidlen -= sizeof (*d6o);
        if (cidlen < sizeof (cidtype))
                return (B_TRUE);

        bcopy(cid, &cidtype, sizeof (cidtype));
        cidtype = ntohs(cidtype);
        if (cidtype == DHCPV6_DUID_LLT && cidlen >= sizeof (duid_llt_t)) {
                lladdr = cid + sizeof (duid_llt_t);
                addrlen = cidlen - sizeof (duid_llt_t);
        }
        if (cidtype == DHCPV6_DUID_LL && cidlen >= sizeof (duid_ll_t)) {
                lladdr = cid + sizeof (duid_ll_t);
                addrlen = cidlen - sizeof (duid_ll_t);
        }
        maclen = mcip->mci_mip->mi_info.mi_addr_length;
        if (lladdr != NULL && addrlen == maclen &&
            bcmp(mcip->mci_unicast->ma_addr, lladdr, maclen) == 0) {
                return (B_TRUE);
        }
        return (dhcpnospoof_check_cid(p, cid, cidlen));
}

/*
 * Enforce dhcp-nospoof protection.
 */
static int
dhcpnospoof_check(mac_client_impl_t *mcip, mac_protect_t *protect,
    mblk_t *mp, mac_header_info_t *mhip)
{
        size_t          hdrsize = mhip->mhi_hdrsize;
        uint32_t        sap = mhip->mhi_bindsap;
        uchar_t         *start, *end;
        mblk_t          *nmp = NULL;
        int             err;

        err = get_l3_info(mp, hdrsize, &start, &end, &nmp);
        if (err != 0) {
                DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
                    mblk_t *, mp);
                return (err);
        }
        err = EINVAL;

        switch (sap) {
        case ETHERTYPE_IP: {
                ipha_t  *ipha = (ipha_t *)start;

                if (start + sizeof (ipha_t) > end)
                        goto fail;

                if (!dhcpnospoof_check_v4(mcip, protect, ipha, end))
                        goto fail;

                break;
        }
        case ETHERTYPE_IPV6: {
                ip6_t           *ip6h = (ip6_t *)start;

                if (start + sizeof (ip6_t) > end)
                        goto fail;

                if (!dhcpnospoof_check_v6(mcip, protect, ip6h, end))
                        goto fail;

                break;
        }
        }
        freemsg(nmp);
        return (0);

fail:
        /* increment dhcpnospoof stat here */
        freemsg(nmp);
        return (err);
}

/*
 * This is called whenever the mac client's mac address changes, to make sure
 * we allow use of the new link-local address.
 */
static void
mac_protect_update_v6_local_addr(mac_client_impl_t *mcip)
{
        uint_t          i;
        in6_addr_t      *token = &mcip->mci_v6_mac_token;
        in6_addr_t      *v6addr = &mcip->mci_v6_local_addr;
        in6_addr_t      ll_template = IN6ADDR_INITIALIZER(V6_LINKLOCAL, 0x0,
                                                          0x0, 0x0);

        for (i = 0; i < 4; i++) {
                v6addr->s6_addr32[i] = token->s6_addr32[i] |
                    ll_template.s6_addr32[i];
        }
        mcip->mci_protect_flags |= MPT_FLAG_V6_LOCAL_ADDR_SET;
}

/*
 * This is called whenever the mac client's mac address changes, to make sure
 * that any existing addresses gained via SLAAC are appropriately updated.
 */
static void
mac_protect_update_v6_slaac_addr(mac_client_impl_t *mcip)
{
        void            *cookie = NULL;
        avl_tree_t      temp_tree;
        avl_tree_t      *ttp = &temp_tree, *sip = &mcip->mci_v6_slaac_ip;
        in6_addr_t      *token = &mcip->mci_v6_mac_token;
        slaac_addr_t    *addr = NULL;

        avl_create(ttp, compare_slaac_ip, sizeof (slaac_addr_t),
            offsetof(slaac_addr_t, sla_node));

        /* Copy everything over to the temporary tree, and fix the IP address */
        while ((addr = avl_destroy_nodes(sip, &cookie)) != NULL) {
                VERIFY(insert_slaac_ip(ttp, token, addr) == B_TRUE);
        }

        /*
         * Now that the tempory tree has all of the modified addresses, we can
         * swap them over to the original tree once it's reset.
         */
        avl_destroy(sip);
        avl_create(sip, compare_slaac_ip, sizeof (slaac_addr_t),
            offsetof(slaac_addr_t, sla_node));
        avl_swap(ttp, sip);
}

/*
 * After the unicast MAC address changes, we need to update the derived token,
 * and update the IPv6 addresses that use the token.
 */
void
mac_protect_update_mac_token(mac_client_impl_t *mcip)
{
        uint_t          media = mcip->mci_mip->mi_info.mi_media;
        uint8_t         *p, *macaddr = mcip->mci_unicast->ma_addr;
        in6_addr_t      *token = &mcip->mci_v6_mac_token;

        bzero(token, sizeof (in6_addr_t));
        p = (uint8_t *)&token->s6_addr32[2];

        switch (media) {
        case DL_ETHER:
                bcopy(macaddr, p, 3);
                p[0] ^= 0x2;
                p[3] = 0xff;
                p[4] = 0xfe;
                bcopy(macaddr + 3, p + 5, 3);
                break;
        case DL_IB:
                ASSERT(mcip->mci_mip->mi_info.mi_addr_length == 20);
                bcopy(macaddr + 12, p, 8);
                p[0] |= 2;
                break;
        default:
                /*
                 * We do not need to generate the local address for link types
                 * that do not support link protection. Wifi pretends to be
                 * Ethernet so it is covered by the DL_ETHER case (note the
                 * use of mi_media instead of mi_nativemedia).
                 */
                return;
        }

        mac_protect_update_v6_local_addr(mcip);
        mac_protect_update_v6_slaac_addr(mcip);
}



/*
 * Enforce link protection on one packet.
 */
static int
mac_protect_check_one(mac_client_impl_t *mcip, mblk_t *mp)
{
        mac_impl_t              *mip = mcip->mci_mip;
        mac_resource_props_t    *mrp = MCIP_RESOURCE_PROPS(mcip);
        mac_protect_t           *protect;
        mac_header_info_t       mhi;
        uint32_t                types;
        int                     err;

        ASSERT(mp->b_next == NULL);
        ASSERT(mrp != NULL);

        err = mac_vlan_header_info((mac_handle_t)mip, mp, &mhi);
        if (err != 0) {
                DTRACE_PROBE2(invalid__header, mac_client_impl_t *, mcip,
                    mblk_t *, mp);
                return (err);
        }
        protect = &mrp->mrp_protect;
        types = protect->mp_types;

        if ((types & MPT_MACNOSPOOF) != 0) {
                if (mhi.mhi_saddr != NULL &&
                    bcmp(mcip->mci_unicast->ma_addr, mhi.mhi_saddr,
                    mip->mi_info.mi_addr_length) != 0) {
                        BUMP_STAT(mcip, macspoofed);
                        DTRACE_PROBE2(mac__nospoof__fail,
                            mac_client_impl_t *, mcip, mblk_t *, mp);
                        return (EINVAL);
                }
        }
        if ((types & MPT_RESTRICTED) != 0) {
                uint32_t        vid = VLAN_ID(mhi.mhi_tci);
                uint32_t        sap = mhi.mhi_bindsap;

                /*
                 * ETHERTYPE_VLAN packets are allowed through, provided that
                 * the vid is not spoofed.
                 */
                if (vid != 0 && !mac_client_check_flow_vid(mcip, vid)) {
                        BUMP_STAT(mcip, restricted);
                        DTRACE_PROBE2(restricted__vid__invalid,
                            mac_client_impl_t *, mcip, mblk_t *, mp);
                        return (EINVAL);
                }

                if (sap != ETHERTYPE_IP && sap != ETHERTYPE_IPV6 &&
                    sap != ETHERTYPE_ARP) {
                        BUMP_STAT(mcip, restricted);
                        DTRACE_PROBE2(restricted__fail,
                            mac_client_impl_t *, mcip, mblk_t *, mp);
                        return (EINVAL);
                }
        }
        if ((types & MPT_IPNOSPOOF) != 0) {
                if ((err = ipnospoof_check(mcip, protect, mp, &mhi)) != 0) {
                        BUMP_STAT(mcip, ipspoofed);
                        DTRACE_PROBE2(ip__nospoof__fail,
                            mac_client_impl_t *, mcip, mblk_t *, mp);
                        return (err);
                }
        }
        if ((types & MPT_DHCPNOSPOOF) != 0) {
                if ((err = dhcpnospoof_check(mcip, protect, mp, &mhi)) != 0) {
                        BUMP_STAT(mcip, dhcpspoofed);
                        DTRACE_PROBE2(dhcp__nospoof__fail,
                            mac_client_impl_t *, mcip, mblk_t *, mp);
                        return (err);
                }
        }
        return (0);
}

/*
 * Enforce link protection on a packet chain.
 * Packets that pass the checks are returned back to the caller.
 */
mblk_t *
mac_protect_check(mac_client_handle_t mch, mblk_t *mp)
{
        mac_client_impl_t       *mcip = (mac_client_impl_t *)mch;
        mblk_t                  *ret_mp = NULL, **tailp = &ret_mp, *next;

        /*
         * Skip checks if we are part of an aggr.
         */
        if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) != 0)
                return (mp);

        for (; mp != NULL; mp = next) {
                next = mp->b_next;
                mp->b_next = NULL;

                if (mac_protect_check_one(mcip, mp) == 0) {
                        *tailp = mp;
                        tailp = &mp->b_next;
                } else {
                        freemsg(mp);
                }
        }
        return (ret_mp);
}

/*
 * Check if a particular protection type is enabled.
 */
boolean_t
mac_protect_enabled(mac_client_handle_t mch, uint32_t type)
{
        return (MAC_PROTECT_ENABLED((mac_client_impl_t *)mch, type));
}

static int
validate_ips(mac_protect_t *p)
{
        uint_t          i, j;

        if (p->mp_ipaddrcnt == MPT_RESET)
                return (0);

        if (p->mp_ipaddrcnt > MPT_MAXIPADDR)
                return (EINVAL);

        for (i = 0; i < p->mp_ipaddrcnt; i++) {
                mac_ipaddr_t    *addr = &p->mp_ipaddrs[i];

                /*
                 * The unspecified address is implicitly allowed so there's no
                 * need to add it to the list. Also, validate that the netmask,
                 * if any, is sane for the specific version of IP. A mask of
                 * some kind is always required.
                 */
                if (addr->ip_netmask == 0)
                        return (EINVAL);

                if (addr->ip_version == IPV4_VERSION) {
                        if (V4_PART_OF_V6(addr->ip_addr) == INADDR_ANY)
                                return (EINVAL);
                        if (addr->ip_netmask > 32)
                                return (EINVAL);
                } else if (addr->ip_version == IPV6_VERSION) {
                        if (IN6_IS_ADDR_UNSPECIFIED(&addr->ip_addr))
                                return (EINVAL);

                        if (IN6_IS_ADDR_V4MAPPED_ANY(&addr->ip_addr))
                                return (EINVAL);

                        if (addr->ip_netmask > 128)
                                return (EINVAL);
                } else {
                        /* invalid ip version */
                        return (EINVAL);
                }

                for (j = 0; j < p->mp_ipaddrcnt; j++) {
                        mac_ipaddr_t    *addr1 = &p->mp_ipaddrs[j];

                        if (i == j || addr->ip_version != addr1->ip_version)
                                continue;

                        /* found a duplicate */
                        if ((addr->ip_version == IPV4_VERSION &&
                            V4_PART_OF_V6(addr->ip_addr) ==
                            V4_PART_OF_V6(addr1->ip_addr)) ||
                            IN6_ARE_ADDR_EQUAL(&addr->ip_addr,
                            &addr1->ip_addr))
                                return (EINVAL);
                }
        }
        return (0);
}

/* ARGSUSED */
static int
validate_cids(mac_protect_t *p)
{
        uint_t          i, j;

        if (p->mp_cidcnt == MPT_RESET)
                return (0);

        if (p->mp_cidcnt > MPT_MAXCID)
                return (EINVAL);

        for (i = 0; i < p->mp_cidcnt; i++) {
                mac_dhcpcid_t   *cid = &p->mp_cids[i];

                if (cid->dc_len > MPT_MAXCIDLEN ||
                    (cid->dc_form != CIDFORM_TYPED &&
                    cid->dc_form != CIDFORM_HEX &&
                    cid->dc_form != CIDFORM_STR))
                        return (EINVAL);

                for (j = 0; j < p->mp_cidcnt; j++) {
                        mac_dhcpcid_t   *cid1 = &p->mp_cids[j];

                        if (i == j || cid->dc_len != cid1->dc_len)
                                continue;

                        /* found a duplicate */
                        if (bcmp(cid->dc_id, cid1->dc_id, cid->dc_len) == 0)
                                return (EINVAL);
                }
        }
        return (0);
}

/*
 * Sanity-checks parameters given by userland.
 */
int
mac_protect_validate(mac_resource_props_t *mrp)
{
        mac_protect_t   *p = &mrp->mrp_protect;
        int             err;

        /* check for invalid types */
        if (p->mp_types != MPT_RESET && (p->mp_types & ~MPT_ALL) != 0)
                return (EINVAL);

        if ((err = validate_ips(p)) != 0)
                return (err);

        if ((err = validate_cids(p)) != 0)
                return (err);

        return (0);
}

/*
 * Enable/disable link protection.
 */
int
mac_protect_set(mac_client_handle_t mch, mac_resource_props_t *mrp)
{
        mac_client_impl_t       *mcip = (mac_client_impl_t *)mch;
        mac_impl_t              *mip = mcip->mci_mip;
        uint_t                  media = mip->mi_info.mi_nativemedia;
        int                     err;

        ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));

        /* tunnels are not supported */
        if (media == DL_IPV4 || media == DL_IPV6 || media == DL_6TO4)
                return (ENOTSUP);

        if ((err = mac_protect_validate(mrp)) != 0)
                return (err);

        if (err != 0)
                return (err);

        mac_update_resources(mrp, MCIP_RESOURCE_PROPS(mcip), B_FALSE);
        i_mac_notify(((mcip->mci_state_flags & MCIS_IS_VNIC) != 0 ?
            mcip->mci_upper_mip : mip), MAC_NOTE_ALLOWED_IPS);
        return (0);
}

void
mac_protect_update(mac_resource_props_t *new, mac_resource_props_t *curr)
{
        mac_protect_t   *np = &new->mrp_protect;
        mac_protect_t   *cp = &curr->mrp_protect;
        uint32_t        types = np->mp_types;

        if (types == MPT_RESET) {
                cp->mp_types = 0;
                curr->mrp_mask &= ~MRP_PROTECT;
        } else {
                if (types != 0) {
                        cp->mp_types = types;
                        curr->mrp_mask |= MRP_PROTECT;
                }
        }
        if (np->mp_ipaddrcnt != 0) {
                if (np->mp_ipaddrcnt <= MPT_MAXIPADDR) {
                        bcopy(np->mp_ipaddrs, cp->mp_ipaddrs,
                            sizeof (cp->mp_ipaddrs));
                        cp->mp_ipaddrcnt = np->mp_ipaddrcnt;
                } else if (np->mp_ipaddrcnt == MPT_RESET) {
                        bzero(cp->mp_ipaddrs, sizeof (cp->mp_ipaddrs));
                        cp->mp_ipaddrcnt = 0;
                }
        }
        if (np->mp_cidcnt != 0) {
                if (np->mp_cidcnt <= MPT_MAXCID) {
                        bcopy(np->mp_cids, cp->mp_cids, sizeof (cp->mp_cids));
                        cp->mp_cidcnt = np->mp_cidcnt;
                } else if (np->mp_cidcnt == MPT_RESET) {
                        bzero(cp->mp_cids, sizeof (cp->mp_cids));
                        cp->mp_cidcnt = 0;
                }
        }
}

void
mac_protect_init(mac_client_impl_t *mcip)
{
        mutex_init(&mcip->mci_protect_lock, NULL, MUTEX_DRIVER, NULL);
        mcip->mci_protect_flags = 0;
        mcip->mci_txn_cleanup_tid = 0;
        avl_create(&mcip->mci_v4_pending_txn, compare_dhcpv4_xid,
            sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_node));
        avl_create(&mcip->mci_v4_completed_txn, compare_dhcpv4_cid,
            sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_node));
        avl_create(&mcip->mci_v4_dyn_ip, compare_dhcpv4_ip,
            sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_ipnode));
        avl_create(&mcip->mci_v6_pending_txn, compare_dhcpv6_xid,
            sizeof (dhcpv6_txn_t), offsetof(dhcpv6_txn_t, dt_node));
        avl_create(&mcip->mci_v6_cid, compare_dhcpv6_cid,
            sizeof (dhcpv6_cid_t), offsetof(dhcpv6_cid_t, dc_node));
        avl_create(&mcip->mci_v6_dyn_ip, compare_dhcpv6_ip,
            sizeof (dhcpv6_addr_t), offsetof(dhcpv6_addr_t, da_node));
        avl_create(&mcip->mci_v6_slaac_ip, compare_slaac_ip,
            sizeof (slaac_addr_t), offsetof(slaac_addr_t, sla_node));

        if (mcip->mci_state_flags & MCIS_IS_VNIC)
                mcip->mci_protect_flags |= MPT_FLAG_PROMISC_FILTERED;
}

void
mac_protect_fini(mac_client_impl_t *mcip)
{
        avl_destroy(&mcip->mci_v6_dyn_ip);
        avl_destroy(&mcip->mci_v6_cid);
        avl_destroy(&mcip->mci_v6_pending_txn);
        avl_destroy(&mcip->mci_v4_dyn_ip);
        avl_destroy(&mcip->mci_v4_completed_txn);
        avl_destroy(&mcip->mci_v4_pending_txn);
        avl_destroy(&mcip->mci_v6_slaac_ip);
        mcip->mci_txn_cleanup_tid = 0;
        mcip->mci_protect_flags = 0;
        mutex_destroy(&mcip->mci_protect_lock);
}

static boolean_t
allowed_ips_set(mac_resource_props_t *mrp, uint32_t af)
{
        int i;

        for (i = 0; i < mrp->mrp_protect.mp_ipaddrcnt; i++) {
                if (mrp->mrp_protect.mp_ipaddrs[i].ip_version == af)
                        return (B_TRUE);
        }
        return (B_FALSE);
}

mac_protect_t *
mac_protect_get(mac_handle_t mh)
{
        mac_impl_t *mip = (mac_impl_t *)mh;

        return (&mip->mi_resource_props.mrp_protect);
}